Assume that the user has all the privileges of the application (IIRC tricking privileged applications into doing things for you was all the rage in linux privil

Assume that the user has all the privileges of the application (IIRC tricking privileged applications into doing things for you was all the rage in linux privilege escalation attacks back in the day) Apply the principle of least privilege. Either the user doesnt get access to the LLM or the LLM doesnt get access to the tool.